80 lines
2.8 KiB
YAML
80 lines
2.8 KiB
YAML
# services/harbor/hermes-chat-router-immutability-job.yaml
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: harbor-hermes-chat-router-immutability-ensure-1
|
|
namespace: harbor
|
|
spec:
|
|
backoffLimit: 2
|
|
activeDeadlineSeconds: 600
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
vault.hashicorp.com/agent-inject: "true"
|
|
vault.hashicorp.com/agent-pre-populate-only: "true"
|
|
vault.hashicorp.com/agent-run-as-user: "65532"
|
|
vault.hashicorp.com/agent-run-as-group: "65532"
|
|
vault.hashicorp.com/role: harbor-policy-bootstrap
|
|
vault.hashicorp.com/agent-inject-secret-harbor-admin-password: kv/data/atlas/harbor/harbor-core
|
|
vault.hashicorp.com/agent-inject-template-harbor-admin-password: |
|
|
{{- with secret "kv/data/atlas/harbor/harbor-core" -}}
|
|
{{ .Data.data.harbor_admin_password }}
|
|
{{- end -}}
|
|
spec:
|
|
serviceAccountName: harbor-policy-bootstrap
|
|
enableServiceLinks: false
|
|
restartPolicy: Never
|
|
nodeSelector:
|
|
hardware: rpi5
|
|
kubernetes.io/arch: arm64
|
|
node-role.kubernetes.io/worker: "true"
|
|
affinity:
|
|
nodeAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
nodeSelectorTerms:
|
|
- matchExpressions:
|
|
- key: kubernetes.io/hostname
|
|
operator: NotIn
|
|
values: [titan-04, titan-14, titan-18, titan-19, titan-24]
|
|
securityContext:
|
|
fsGroup: 65532
|
|
fsGroupChangePolicy: OnRootMismatch
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
containers:
|
|
- name: ensure
|
|
image: docker.io/library/python@sha256:efcdfa6a6b2fd2afb9c7dfa9a5b288a6f68338b5cfdebe6b637d986067d85757
|
|
imagePullPolicy: IfNotPresent
|
|
command: [python3, /scripts/harbor_hermes_chat_router_immutability_ensure.py]
|
|
env:
|
|
- name: HARBOR_API_ORIGIN
|
|
value: https://registry.bstein.dev/api/v2.0
|
|
- name: HARBOR_ADMIN_PASSWORD_FILE
|
|
value: /vault/secrets/harbor-admin-password
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop: ["ALL"]
|
|
readOnlyRootFilesystem: true
|
|
runAsGroup: 65532
|
|
runAsNonRoot: true
|
|
runAsUser: 65532
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
volumeMounts:
|
|
- name: scripts
|
|
mountPath: /scripts
|
|
readOnly: true
|
|
- name: tmp
|
|
mountPath: /tmp
|
|
resources:
|
|
requests: {cpu: 25m, memory: 32Mi}
|
|
limits: {cpu: 250m, memory: 128Mi}
|
|
volumes:
|
|
- name: scripts
|
|
configMap:
|
|
name: harbor-hermes-chat-router-immutability-script
|
|
defaultMode: 0555
|
|
- name: tmp
|
|
emptyDir: {}
|